CVE-2026-53306
tty: hvc_iucv: fix off-by-one in number of supported devices
Description
In the Linux kernel, the following vulnerability has been resolved: tty: hvc_iucv: fix off-by-one in number of supported devices MAX_HVC_IUCV_LINES == HVC_ALLOC_TTY_ADAPTERS == 8. This is the number of entries in: static struct hvc_iucv_private *hvc_iucv_table[MAX_HVC_IUCV_LINES]; Sometimes hvc_iucv_table[] is limited by: (a) if (num > hvc_iucv_devices) // for error detection or (b) for (i = 0; i < hvc_iucv_devices; i++) // in 2 places (so these 2 don't agree; second one appears to be correct to me.) hvc_iucv_devices can be 0..8. This is a counter. (c) if (hvc_iucv_devices > MAX_HVC_IUCV_LINES) If hvc_iucv_devices == 8, (a) allows the code to access hvc_iucv_table[8]. Oops.
INFO
Published Date :
June 26, 2026, 8:17 p.m.
Last Modified :
July 6, 2026, 8:14 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update the Linux kernel to the latest version.
- Apply the provided patch for hvc_iucv.
- Verify the device support count logic.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53306.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53306 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53306
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53306 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53306 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 06, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-193 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.141 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.91 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.33 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.175 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.209 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 2.6.29 up to (excluding) 5.10.258 Added Reference Type kernel.org: https://git.kernel.org/stable/c/11207e42a332eb8bbcb9fe74df9edd2a807c5607 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/3104a3f40feb107f77d7116ad9bf6c210ab7babf Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/3d3b89e6ab93bdd0efd45828bda6b0e61cc46dff Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/484357dff256c816d9466bda35eb765685e4dc86 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a76511bc654819425d3b15e77b523d7f9d81f064 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/f1dc8e72de9aabe5d96767a4e97219ac26b79fe5 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/f2a880e802ad12d1e38039d1334fb1475d0f5241 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/fed8b8f33a46db0ee2efdb000f4f630c86ed8ca4 Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 26, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '44a01d5ba8a4d543694461cd3e178cfa6b3f221b', 'lessThan': '3d3b89e6ab93bdd0efd45828bda6b0e61cc46dff', 'versionType': 'git'}, {'status': 'affected', 'version': '44a01d5ba8a4d543694461cd3e178cfa6b3f221b', 'lessThan': '484357dff256c816d9466bda35eb765685e4dc86', 'versionType': 'git'}, {'status': 'affected', 'version': '44a01d5ba8a4d543694461cd3e178cfa6b3f221b', 'lessThan': '11207e42a332eb8bbcb9fe74df9edd2a807c5607', 'versionType': 'git'}, {'status': 'affected', 'version': '44a01d5ba8a4d543694461cd3e178cfa6b3f221b', 'lessThan': 'fed8b8f33a46db0ee2efdb000f4f630c86ed8ca4', 'versionType': 'git'}, {'status': 'affected', 'version': '44a01d5ba8a4d543694461cd3e178cfa6b3f221b', 'lessThan': 'a76511bc654819425d3b15e77b523d7f9d81f064', 'versionType': 'git'}, {'status': 'affected', 'version': '44a01d5ba8a4d543694461cd3e178cfa6b3f221b', 'lessThan': '3104a3f40feb107f77d7116ad9bf6c210ab7babf', 'versionType': 'git'}, {'status': 'affected', 'version': '44a01d5ba8a4d543694461cd3e178cfa6b3f221b', 'lessThan': 'f1dc8e72de9aabe5d96767a4e97219ac26b79fe5', 'versionType': 'git'}, {'status': 'affected', 'version': '44a01d5ba8a4d543694461cd3e178cfa6b3f221b', 'lessThan': 'f2a880e802ad12d1e38039d1334fb1475d0f5241', 'versionType': 'git'}], 'programFiles': ['drivers/tty/hvc/hvc_iucv.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.29'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.29', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.141', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.91', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/tty/hvc/hvc_iucv.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: tty: hvc_iucv: fix off-by-one in number of supported devices MAX_HVC_IUCV_LINES == HVC_ALLOC_TTY_ADAPTERS == 8. This is the number of entries in: static struct hvc_iucv_private *hvc_iucv_table[MAX_HVC_IUCV_LINES]; Sometimes hvc_iucv_table[] is limited by: (a) if (num > hvc_iucv_devices) // for error detection or (b) for (i = 0; i < hvc_iucv_devices; i++) // in 2 places (so these 2 don't agree; second one appears to be correct to me.) hvc_iucv_devices can be 0..8. This is a counter. (c) if (hvc_iucv_devices > MAX_HVC_IUCV_LINES) If hvc_iucv_devices == 8, (a) allows the code to access hvc_iucv_table[8]. Oops. Added Reference https://git.kernel.org/stable/c/11207e42a332eb8bbcb9fe74df9edd2a807c5607 Added Reference https://git.kernel.org/stable/c/3104a3f40feb107f77d7116ad9bf6c210ab7babf Added Reference https://git.kernel.org/stable/c/3d3b89e6ab93bdd0efd45828bda6b0e61cc46dff Added Reference https://git.kernel.org/stable/c/484357dff256c816d9466bda35eb765685e4dc86 Added Reference https://git.kernel.org/stable/c/a76511bc654819425d3b15e77b523d7f9d81f064 Added Reference https://git.kernel.org/stable/c/f1dc8e72de9aabe5d96767a4e97219ac26b79fe5 Added Reference https://git.kernel.org/stable/c/f2a880e802ad12d1e38039d1334fb1475d0f5241 Added Reference https://git.kernel.org/stable/c/fed8b8f33a46db0ee2efdb000f4f630c86ed8ca4